Payouts King Scheduled Task Persistence via Mozilla UpdateTask or ElevateTask

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the Payouts King malware creating, running, or deleting specific scheduled tasks named \Mozilla\UpdateTask or \Mozilla\ElevateTask, as well as indirect execution of these tasks via cmd.exe redirection.